Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Always return an error when confirmation_token is blank #5132

Merged
merged 4 commits into from Sep 4, 2019
Merged

Always return an error when confirmation_token is blank #5132

merged 4 commits into from Sep 4, 2019

Commits on Aug 12, 2019

  1. Do not confirm users when confirmation_token is blank 

    As reported in #5071, if
for some reason, a user in the database had the `confirmation_token`
column as a blank string, Devise would confirm that user after receiving
a request with a blank `confirmation_token` parameter.
After this commit, a request sending a blank `confirmation_token`
parameter will receive a validation error.
For applications that have users with a blank `confirmation_token` in
the database, it's recommended to manually regenerate or to nullify
them.
    @tegon
    tegon committed Aug 12, 2019
    Copy the full SHA
    f66c996 View commit details
    Browse the repository at this point in the history

  2. Add comments about the code

    @tegon
    tegon committed Aug 12, 2019
    Copy the full SHA
    30508da View commit details
    Browse the repository at this point in the history

  3. Tweak the tests

    @tegon
    tegon committed Aug 12, 2019
    Copy the full SHA
    624049a View commit details
    Browse the repository at this point in the history

Commits on Sep 3, 2019

  1. Return early when confirmation_token is blank

    @tegon
    tegon committed Sep 3, 2019
    Copy the full SHA
    0ea4bd7 View commit details
    Browse the repository at this point in the history